Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Line of Death

textslashplain.com

Post reply on HN
Print view View original

101–108 of 108 posts

Re: The Line of Death

#101

Post by colejohnson66 »

Senji wrote: post #94
SEMW wrote: post #81

Earlier quoted context omitted.

It's a nice design. But in this particular case, does it matter? What's the threat, that the credentials you enter into a fake basic auth box could be sent to the server? The credentials you enter into a real basic auth box are just sent to the server -- basic auth doesn't do any password hashing clientside. Why would a phishing site (that's pretending to be another site that uses basic auth) fake a basic auth box wh…

Does the real authbox include a domain that's asking?

Yes

Re: The Line of Death

#103

Post by breakingcups »

xg15 wrote: post #92

> Unfortunately, on windowed operating systems, this is worse than it sounds, because it creates the possibility of picture-in-picture attacks, where an entire browser window, including its trusted pixels, can be faked [...] They retorted “Well, we passed this screenshot around our entire information security department, and nobody could tell it’s a picture-in-picture attack. Can you?” Maybe I'm naive, but shouldn't…

A few websites I know will pop up a separate window for entering credit card credentials.

Re: The Line of Death

#104

Post by Flenser »

kibwen wrote: post #20

I've never heard the term "line of death" used to describe this before, but this concept is exactly why I've sadly convinced myself that fully chromeless browsers are a bad idea. Unless there were some sort of spoofless hardware indicator that a given UI element was being displayed by the browser, I suppose... but that sort of defeats the purpose.

How about, in the same way that some banks allow you to upload an image that they can then show you to prove you're talking to the same party that you've talked to previously, a chromeless browser could ask you to "draw" or supply an image for trusted actions. This "badge of trust" could then be show inside any dialog that asks the user to perform any action that you would not want a website to fake. It would of course be important that untrusted website content is never able to read these pixels.

This is essentially inverting the relationship, by inserting a "zone of life" inside the "zone of death".

Re: The Line of Death

#105

Post by dwe3000 »

notriddle wrote: post #38
hlandau wrote: post #32

Earlier quoted context omitted.

You can still do this as late as Win7. I think this was eliminated in Win8, but I've not used it myself. If you do use Aero, you can change the window chrome colour to something custom, which should catch out sites trying to fake windows. I don't think browsers provide any way to get the window chrome colour, though come to think of it, I'm fairly sure IE does/used to provide system colour names in CSS, so it might n…

Windows 10 lets you pick a "custom accent color," and it allows you to make a few other custom tweaks as well (should the titlebar be white or colored?). Since this is part of the initial setup wizard, I think it would be pretty hard to fake a Windows 10 dialog from inside a web browser.

CSS System Colors support[1] in Windows/IE makes this harder to stop than you many realize. I don't see it very much anymore, but when it first came out, I saw quite a bit of this.

[1]: http://www.w3.org/TR/css3-color/#css2-system

Re: The Line of Death

#106

Post by Terr_ »

ghurtado wrote: post #91
Terr_ wrote: post #78

Earlier quoted context omitted.

I believe that "kids these days are good with technology" is a phrase uttered by older people who are actually seeing the kids' willingness to experiment without fear, and assume that it must mean proficiency. Not quite the same thing in the end, though.

> Not quite the same thing in the end, though. For all intents and purposes, it is. I do not know a single person who I would term "proficient with technology" who is afraid of experimenting or overly concerned about making mistakes when using something new. In my experience, people who are "good with technology" are always curious hackers and tinkerers who are unafraid of breaking things, and are never satisfied wit…

> For all intents and purposes, it is.

The vast majority of them max out their skillset with being a consumer (e.g. social media apps) and install a bit of malware along the way.

Re: The Line of Death

#107

Post by jazzdev »

ghurtado wrote: post #91
Terr_ wrote: post #78

Earlier quoted context omitted.

I believe that "kids these days are good with technology" is a phrase uttered by older people who are actually seeing the kids' willingness to experiment without fear, and assume that it must mean proficiency. Not quite the same thing in the end, though.

> Not quite the same thing in the end, though. For all intents and purposes, it is. I do not know a single person who I would term "proficient with technology" who is afraid of experimenting or overly concerned about making mistakes when using something new. In my experience, people who are "good with technology" are always curious hackers and tinkerers who are unafraid of breaking things, and are never satisfied wit…

My sister gave me my favorite definition of "computer literate": Someone that isn't afraid of the computer.

The worse thing that's every happened to me because of my lack of fear was that I fried the motherboard on a friend's Mac back in the 90's by plugging a parallel printer into a SCSI port. Oops! Fortunately it was under warranty.

Re: The Line of Death

#108

Post by RugnirViking »

inconclusive wrote: post #52

Why is there a line of death to begin with? The picture-in-picture attacks seem serious enough to warrant a new kind of browser.

How could we eliminate the line of death? There has to be a part of the page that we hand control to the site, otherwise there wouldn't be any content, and the line of death is just the boundaries of that.
Post reply on HN